Illinois Governor Signs Landmark AI Act With First-in-Nation Mandatory Third-Party Audit for Frontier Models

Illinois Governor JB Pritzker has signed the Artificial Intelligence Safety Measures Act (SB 315) into law, establishing one of the most stringent regulatory frameworks for advanced AI in the United States. The legislation makes Illinois the first state to require mandatory, independent third-party audits for developers of massive "frontier" AI models. [1][3][1][3]

The new law targets the largest and most resource-intensive artificial intelligence systems—specifically those trained using more than 10²⁶ floating-point operations by companies generating over $500 million in annual revenue. [6][7] By setting these high thresholds, the legislation focuses squarely on industry giants like OpenAI, Google, Anthropic, and Meta, rather than stifling smaller startups or open-source researchers. [4][6][4][6]

The centerpiece of the legislation is its unprecedented audit mandate. Beginning in 2028, large frontier developers must hire independent third-party evaluators to annually assess their compliance with safety protocols and internal risk controls. [6][8] Crucially, the law stipulates strict independence criteria, ensuring that auditors have no financial conflicts of interest with the tech companies they are evaluating. [8][6][7]

Beyond audits, the law requires developers to publish comprehensive safety frameworks detailing how they identify and mitigate "catastrophic risks"—such as the potential for an AI model to assist in creating biological weapons or executing large-scale cyberattacks. [1][7] Companies must also report critical safety incidents to the Illinois Emergency Management Agency and Office of Homeland Security within 72 hours, or just 24 hours if the risk is deemed imminent. [5][6][1][5][6]

Enforcement of the new regulations falls exclusively to the Illinois Attorney General, who can levy civil penalties of up to $1 million for a first violation and $3 million for subsequent offenses. [3][8] The legislation does not include a private right of action, meaning individual citizens cannot sue AI companies directly under this specific law for algorithmic harms, a compromise that helped secure broad bipartisan support. [4][5][3][4][5][7]

During the signing ceremony in Chicago, Governor Pritzker framed the legislation as a necessary intervention in the face of federal gridlock. He emphasized that the state is choosing a path of "innovation with security," ensuring that the costs and detriments of unchecked technological growth are not pushed onto ordinary citizens. [1][3] Pritzker openly criticized Congress for remaining captive to special interests and failing to pass a cohesive national framework. [1][2][1][2][3]

Illinois now joins California and New York, which passed similar frontier AI transparency laws in late 2025. [1][2] Legal experts note that because these three states collectively account for roughly 40% of the U.S. AI market, their combined regulations effectively create a de facto national standard. [1][6] It is logistically unfeasible for major tech companies to build separate AI models for different states, meaning the Illinois audit requirement will likely become standard industry practice nationwide. [6][8][1][2][6][7]

The tech industry's reaction has been surprisingly cooperative. Major players like OpenAI have publicly endorsed the Illinois framework, describing it as one of the strongest safety laws in the country. [6] This support reflects a growing consensus among leading labs that clear, predictable state regulations are preferable to a chaotic patchwork of conflicting local ordinances or the looming threat of more draconian federal interventions. [6][7][6]

The transparency and reporting provisions of the Artificial Intelligence Safety Measures Act will officially take effect on January 1, 2027, giving developers a brief runway to align their internal compliance programs. [6][8] The more rigorous third-party audit requirements will follow a year later in 2028, marking a critical transition from an era of self-reported AI safety to one of verified, independent oversight. [7][8][6][7]